session management

session

[sjen]

My session variables seem to only last for the first page after log in, and disappear on subsequent pages. I tried different things, and finally added session_start() to every page. Is this the correct fix, or will this cause problems down the road and impact session time out?

[Stormfx]

Unless the php.ini file is set to auto sessions, you have to call session_start() on every page.

[sjen]

would this impact session time out? i would like the session to time out and force users to re-login after 5 to 10 minutes of inactivity.

thanks.

[ergophobe]

5-10 minutes is awfully fast and could be really annoying. Unless you expect that most people will be accessing from shared computers, I would go with something quite a bit longer.

As for implementation, I usually just set a timer with a session var

$_SESSION['active] = now();

for example and then check that on every page call and redirect to login if the time allowance is exceeded. You can't really count on the session garbage collection to do this on any precise schedule unless you build your own session handlers.